netstat.exe,成为病毒了?Mcafee误报？

显示全部楼层 · 发表于 2008-9-3 13:36:25

请有同样问题的人一起确认下！
已经上传

[ 本帖最后由 SummerFisher 于 2008-9-4 18:49 编辑 ]

显示全部楼层 · 发表于 2008-9-3 13:40:00

卡巴前几天也有这个问题，现在轮到mcafee了？
其他电脑复制的netstat，一进电脑就被删掉了！
汗！

显示全部楼层 · 发表于 2008-9-3 13:45:51

建议从其他电脑的相同版本的干净系统拷一个相同文件到C:\windows\system32和C:\windows\system32\dllcache\ 下，用replace替换
netstat.exe本身无毒，可能被感染了

显示全部楼层 · 发表于 2008-9-3 13:49:19

晕，看到有人说卡巴更新后不报了，有可能是误报

显示全部楼层 · 发表于 2008-9-3 14:22:34

有沒有样本呢

显示全部楼层 · 发表于 2008-9-3 14:25:54

看看其他会员的情况。我这里没有反应，一直装的是咖啡8.5

显示全部楼层 · 发表于 2008-9-4 17:27:46

样本在一楼

显示全部楼层 · 发表于 2008-9-4 18:00:02

mcafee补丁6 版本都是最新的~

显示全部楼层 · 发表于 2008-9-4 18:04:15

被感染了？

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2008.9.4.2	2008.09.04	-
AntiVir	7.8.1.28	2008.09.04	-
Authentium	5.1.0.4	2008.09.03	-
Avast	4.8.1195.0	2008.09.03	Win32:Trojan-gen {Other}
AVG	8.0.0.161	2008.09.04	I-Worm/Brontok.KY
BitDefender	7.2	2008.09.04	-
CAT-QuickHeal	9.50	2008.09.02	-
ClamAV	0.93.1	2008.09.04	-
DrWeb	4.44.0.09170	2008.09.04	-
eSafe	7.0.17.0	2008.09.03	-
eTrust-Vet	31.6.6069	2008.09.04	-
Ewido	4.0	2008.09.03	-
F-Prot	4.4.4.56	2008.09.03	-
F-Secure	8.0.14332.0	2008.09.04	-
Fortinet	3.14.0.0	2008.09.03	-
GData	19	2008.09.04	Win32:Trojan-gen
Ikarus	T3.1.1.34.0	2008.09.04	Email-Worm.Win32.Brontok.dr
K7AntiVirus	7.10.439	2008.09.03	-
Kaspersky	7.0.0.125	2008.09.04	-
McAfee	5376	2008.09.03	W32/Rontokbro.gen@MM
Microsoft	1.3903	2008.09.04	-
NOD32v2	3414	2008.09.04	-
Norman	5.80.02	2008.09.04	W32/Rontokbro.GHI
Panda	9.0.0.4	2008.09.03	-
PCTools	4.4.2.0	2008.09.03	Email-Worm.Brontok!sd6
Prevx1	V2	2008.09.04	Worm
Rising	20.60.31.00	2008.09.04	-
Sophos	4.33.0	2008.09.04	-
Sunbelt	3.1.1582.1	2008.09.02	-
Symantec	10	2008.09.04	-
TheHacker	6.3.0.8.072	2008.09.04	-
TrendMicro	8.700.0.1004	2008.09.04	-
VBA32	3.12.8.4	2008.09.03	-
ViRobot	2008.9.4.1363	2008.09.04	-
VirusBuster	4.5.11.0	2008.09.03	-
Webwasher-Gateway	6.6.2	2008.09.04	-

附加信息

File size: 36864 bytes

MD5...: 6de07ba5032225cfa285b8ce277cc1e6

SHA1..: 08ea071074e5cc14194cc77fdde573476957848b

SHA256: a98358ded3da515b8c08a6212a9865f08babe9e968b8b03a63753cd993bb7d89

SHA512: 631e1ba5e6844994f525e8fdd334d7cc5b80db2c09a8f381689c6b61b5ad1164
db44814341c01f0f3049921d183e71a21b2413e8e6076dbd920c4a16f54b07da

PEiD..: -

TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)

PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10039fc
timedatestamp.....: 0x41107d19 (Wed Aug 04 06:07:21 2004)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x4848 0x4a00 6.34 b5cdc3159f21caf39a735845abb14c9c
.data 0x6000 0xb30 0xa00 0.50 7a940d1e8c7a0e5c593f729685ad4bc1
.rsrc 0x7000 0x3740 0x3800 3.24 5ef043c4119aa92824a095dc27df8705

( 10 imports )
> msvcrt.dll: _iob, exit, toupper, sscanf, _strupr, _c_exit, _exit, _XcptFilter, _cexit, __initenv, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, sprintf, _except_handler3, _controlfp, time, fprintf, strchr, _setmode, system
> ADVAPI32.dll: LookupPrivilegeValueA, AdjustTokenPrivileges, OpenProcessToken
> KERNEL32.dll: GetModuleHandleA, SetUnhandledExceptionFilter, UnhandledExceptionFilter, CloseHandle, LoadLibraryA, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, LoadLibraryExA, Sleep, FreeLibrary, HeapFree, GetProcessHeap, OpenProcess, lstrcmpiA, GetProcAddress, GetCurrentProcess, GetSystemTimeAsFileTime, TerminateProcess, GetLastError, GetSystemDirectoryA, LocalFree, FormatMessageA
> DBGHELP.dll: SymInitialize, SymSetSearchPath, SymLoadModuleEx, SymGetModuleInfo64, SymCleanup
> PSAPI.DLL: EnumProcessModules, GetModuleInformation, GetModuleBaseNameA, GetModuleFileNameExA
> iphlpapi.dll: AllocateAndGetTcpExTableFromStack, AllocateAndGetUdpExTableFromStack, GetIcmpStatsFromStackEx, GetUdpStatsFromStackEx, AllocateAndGetUdpExTable2FromStack, GetIpStatsFromStackEx, AllocateAndGetTcpExTable2FromStack, GetTcpStatsFromStackEx
> USER32.dll: CharToOemBuffA
> WS2_32.dll: -, getnameinfo, -, -, -, -
> ntdll.dll: RtlAllocateHeap, RtlFreeHeap, NtQuerySystemInformation
> snmpapi.dll: SnmpUtilVarBindFree, SnmpUtilMemFree, SnmpUtilMemAlloc, SnmpUtilOidCpy

( 0 exports )

Prevx info: http://info.prevx.com/aboutprogr ... 0FC114A8D0005631D92

ThreatExpert info: http://www.threatexpert.com/report.aspx?md5=6de07ba5032225cfa285b8ce277cc1e6

如有和楼主一样版本的此文件，如方便也请反馈一下具体信息。

显示全部楼层 · 发表于 2008-9-4 18:32:44

版本2180

[误报文件] netstat.exe,成为病毒了?Mcafee误报？

回复 2楼 SummerFisher 的帖子

浏览过的版块